Security
Security built into every Alt Auth login
Authentication is the front door to your product. Here is exactly how Alt Auth protects it — what is on for every plan, what comes with higher plans, and where your users’ data is stored.
Is Alt Auth secure?
Alt Auth stores passwords only as salted bcrypt hashes, encrypts every connection with TLS, hosts user data in the EU and alerts you to failed logins on every plan. Two-step verification comes with Starter; IP rules and audit logs with Growth.
At a glance
- bcrypt password hashing on every plan
- TLS on every connection
- User data hosted in the EU
- RS256-signed tokens your app verifies
- Failed-login alerts on every plan
Passwords and sign-in
The parts attackers go after first are the parts we lock down on every plan.
Salted bcrypt password hashes Every plan
Passwords are never stored in plain text or in a reversible form — only as salted bcrypt hashes.
Two-step verification Starter and up
A second step at sign-in, which you can require for staff-facing apps and leave optional for others.
Sign-in links by email Growth and up
Passwordless sign-in links that expire after 15 minutes and work only once.
Password recovery Every plan
A reset flow that is already built, so nobody ships a home-made one.
Spotting and stopping attacks
When something looks wrong you hear about it, and you can act in one click.
Failed-login alerts Every plan
Five failed sign-ins in 15 minutes trigger an email alert — to your team for dashboard accounts and, when you switch it on, to the affected user.
Block users in one click Every plan
Cut off an account straight away from the dashboard.
IP allow and block lists Growth and up
Allow sign-ins only from your office network, or block addresses you do not trust.
Audit logs and manager activity Growth and up
A history of changes and of what each manager did in the dashboard.
Tokens your app can trust
Your app never handles passwords. It receives a signed token and checks it.
RS256-signed tokens (JWT) Every plan
Verify every sign-in with your project’s public key, or with the Verify API.
Token lifetime you choose Starter and up
Set how long a sign-in lasts per project, short for admin tools and longer for consumer apps.
Encryption in transit Every plan
Every connection between your users, your app and Alt Auth uses TLS (HTTPS).
Where your data lives
Alt Auth is a European product, run by WeNoCode OÜ, a company registered in Estonia.
Hosted in the European Union Every plan
Database in AWS Frankfurt, API in AWS Stockholm, file storage in AWS Frankfurt (eu-central-1).
Data processing terms Every plan
Our Terms of Service include data processing terms for the user data you keep with us.
Named sub-processors Every plan
Our Privacy Policy lists the services we use to run Alt Auth.
Soft delete Every plan
Remove users from your app without breaking your records.
How are passwords stored?
Only as salted bcrypt hashes, on every plan including Hobby. Nobody — including us — can read a user’s password back.
Where is my users’ data stored?
In the European Union. The database runs in AWS Frankfurt, the API in AWS Stockholm and file storage in AWS Frankfurt (eu-central-1). Alt Auth is made by WeNoCode OÜ, a company registered in Estonia.
Is traffic encrypted?
Yes. Every connection between your users, your app and Alt Auth is encrypted in transit with TLS (HTTPS). Sign-in results reach your app as RS256-signed tokens (JWTs) that you verify with your project’s public key or the Verify API.
How will I know if someone attacks an account?
Failed-login alerts are on for every plan, and you can block any user in one click. Two-step verification comes with Starter; IP allow and block lists and audit logs with Growth.
Does Alt Auth work for GDPR?
Yes. Our Terms of Service include data processing terms for the user data you keep with us, and our Privacy Policy names the sub-processors we use. Both are linked in the footer of every page.
Give your app a login today
Free up to 1,000 users a month. No card needed. Sign in with Google from day one.